Скачать или смотреть Empowering Istio Ambient with Any Kubernetes CNIs - Benjamin Leggett & Yuval Kohavi, Solo.io

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon North America in Salt Lake City from November 12 - 15, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Empowering Istio Ambient with Any Kubernetes CNIs - Benjamin Leggett & Yuval Kohavi, Solo.io

One of the primary challenges of Istio's ambient mesh is its limited support for CNIs (Container Network Interfaces). Additionally, none of the Kubernetes network policies can be enforced while pods are included in the ambient mesh. This presentation introduces an innovative approach, currently in the process of being upstreamed (expected to be merged before IstioDay EU), to the Istio community. The proposed solution involves redirecting traffic from the pod to Ztunnel within the pod's network namespace. We will delve into how this approach seamlessly operates between Istio-CNI, Ztunnel, and application pods in the ambient mesh, all without requiring any restart of application pods during enrollment into the ambient mesh. We’ll also discuss potential improvements and tradeoffs in the scope of threat model, system resource, network policy and bypassability.